{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-41153", "assignerOrgId": "547ada31-17d8-4964-bc5f-1b8238ba8014", "state": "PUBLISHED", "assignerShortName": "JetBrains", "dateReserved": "2026-04-17T14:24:06.217Z", "datePublished": "2026-04-17T14:29:04.503Z", "dateUpdated": "2026-04-20T14:58:41.237Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "547ada31-17d8-4964-bc5f-1b8238ba8014", "shortName": "JetBrains", "dateUpdated": "2026-04-17T14:29:04.503Z"}, "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-77", "cweId": "CWE-77"}]}], "affected": [{"vendor": "JetBrains", "product": "Junie", "versions": [{"version": "0", "status": "affected", "lessThan": "252.549.29", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "In JetBrains Junie before 252.549.29 command execution was possible via malicious project file"}], "references": [{"url": "https://www.jetbrains.com/privacy-security/issues-fixed/"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "LOCAL", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "availabilityImpact": "LOW", "baseScore": 5.8, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:L"}}]}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-77", "lang": "en", "description": "CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-17T14:53:05.369252Z", "id": "CVE-2026-41153", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-20T14:58:41.237Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-41153", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-17T14:53:05.369252Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-77", "description": "CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-17T14:53:16.162Z"}}], "cna": {"metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.8, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "JetBrains", "product": "Junie", "versions": [{"status": "affected", "version": "0", "lessThan": "252.549.29", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://www.jetbrains.com/privacy-security/issues-fixed/"}], "descriptions": [{"lang": "en", "value": "In JetBrains Junie before 252.549.29 command execution was possible via malicious project file"}], "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-77", "description": "CWE-77"}]}], "providerMetadata": {"orgId": "547ada31-17d8-4964-bc5f-1b8238ba8014", "shortName": "JetBrains", "dateUpdated": "2026-04-17T14:29:04.503Z"}}}, "cveMetadata": {"cveId": "CVE-2026-41153", "state": "PUBLISHED", "dateUpdated": "2026-04-20T14:58:41.237Z", "dateReserved": "2026-04-17T14:24:06.217Z", "assignerOrgId": "547ada31-17d8-4964-bc5f-1b8238ba8014", "datePublished": "2026-04-17T14:29:04.503Z", "assignerShortName": "JetBrains"}, "dataVersion": "5.2"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:jetbrains:junie:*:*:*:*:*:*:*:*", "matchCriteriaId": "009D25C1-A872-458E-86E5-32154697E090", "versionEndExcluding": "252.549.29", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In JetBrains Junie before 252.549.29 command execution was possible via malicious project file"}], "id": "CVE-2026-41153", "lastModified": "2026-04-27T14:58:57.040", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 5.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 1.0, "impactScore": 4.7, "source": "cve@jetbrains.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2026-04-17T15:16:51.853", "references": [{"source": "cve@jetbrains.com", "tags": ["Vendor Advisory"], "url": "https://www.jetbrains.com/privacy-security/issues-fixed/"}], "sourceIdentifier": "cve@jetbrains.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-77"}], "source": "cve@jetbrains.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-77"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,252.549.29)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Junie", "source": "cna", "vendor": "JetBrains"}, "product": "junie", "vendor": "jetbrains"}], "analysis": {"en": {"generated_at": "2026-04-18T17:12:50.739817+00:00", "value": {"mitigation_remediation": ["Upgrade JetBrains Junie to version 252.549.29 or later", "Disable automatic loading of project files from untrusted directories", "Quantify and restrict permissions for the directory where project files are stored"], "summary": {"action": "Immediate Patch", "impact": "Remote Code Execution"}, "threat_synthesis": {"affected_systems": "JetBrains Junie versions prior to 252.549.29 are affected. Any installation of this product that can be supplied with a malicious project file and that has the default configuration for loading such files is vulnerable.", "description_and_impact": "A vulnerability in JetBrains Junie allows an attacker to execute arbitrary operating\u2011system commands by placing a specially crafted project file in a location that the JetBrains Junie application will load. The flaw arises from unsafe handling of external project files, resulting in a classic command injection (CWE\u201177) that can lead to full compromise of the host system if an attacker succeeds. The potential impact includes loss of confidentiality, integrity, and availability of the affected machine, as well as the possibility of using the compromised system to pivot into the broader network.", "risk_and_exploitability": "The CVSS score of 5.8 indicates a moderate risk level. The EPSS score is not available, so current exploitation probability is unclear, but the vulnerability is not listed in CISA\u2019s KEV catalog. Exploitation requires the attacker to supply a malicious project file that the JetBrains Junie application will load; this could be achieved by a local or privileged user who can place the file in a monitored directory or by an attacker who can influence the file selection during the project import process. Based on the description, the likely attack vector is a local or file\u2011based vector rather than remote network exploitation."}}}}, "created": "2026-04-17T15:30:05.880745+00:00", "title": "Command Injection via Malicious Project File in JetBrains Junie", "updated": "2026-04-18T17:15:05.787071+00:00", "vendors": ["jetbrains", "jetbrains$PRODUCT$junie"]}